(BUSAN.SASHIMI)
Weekly Digest // TECH_NEWS — Week 35-2026
newspaperWeekly Report

Valid npm Provenance Publishes Malware — Week 35 Tech News

A poisoned npm workflow, 19 malicious browser extensions, and Firefox's Rust JPEG XL decoder show why trusted delivery paths need their own threat model.

calendar_todaysummarizeWeek 35-2026bolt2 CRITICAL
TAG: SUPPLY CHAINREAD_TIME: 17_MIN

OpenAPI React Query Codegen npm Compromise

Ten malicious @7nohe/openapi-react-query-codegen versions carried valid npm provenance because an issue-comment workflow checked only for the text “npm publish,” then built a pull-request fork with id-token: write. The package receives roughly 150,000 weekly downloads. Its install-time payload targeted registry, cloud, CI, GitHub, and AI-tool credentials, added persistence, and could propagate into other packages and hosts. Teams must treat an installed affected version as a host compromise, not a dependency cleanup.

Read Articlearrow_forward
TAG: BROWSER SECURITYREAD_TIME: 12_MIN

19 Browser Extensions Deliver Wallet-Draining Malware

Socket connected 18 Chrome extensions and one Edge extension to a modular credential-stealing campaign active for more than two years. Five extensions were bought from legitimate authors; the largest Chrome and Edge pair represented a potential 80,000-user exposure. The framework strips Content Security Policy headers, maintains an encrypted WebSocket channel, and injects wallet drainers, seed-phrase phishing, form capture, session theft, and fake updates into visited pages. Automatic extension updates turn ownership transfer into a security boundary.

TAG: BROWSER PLATFORMREAD_TIME: 3_MIN

Mozilla Intends to Ship JPEG XL

Firefox plans to ship JPEG XL after Google Research replaced an approximately 100,000-line multithreaded C++ decoder with the Rust-based jxl-rs implementation Mozilla requested. JPEG XL offers progressive rendering, strong lossless compression, and lossless JPEG recompression; AVIF remains smaller in several web-quality photographic comparisons. With Chrome also intending to ship and Safari already partially supporting the format, developers can begin representative image tests instead of choosing a codec by headline size alone.

summarizeDigest_Summary

Ten malicious versions of @7nohe/openapi-react-query-codegen were published with valid npm provenance after a GitHub Actions workflow trusted the text of an issue comment but not the commenter's association. The package draws about 150,000 weekly downloads, and the payload searched developer machines, CI environments, cloud metadata, registries, and AI-tool configuration for credentials and persistence. Provenance identified the trusted workflow; it could not prove the workflow built trusted source.

Socket also found 18 Chrome extensions and one Edge extension sharing a wallet-draining and credential-stealing framework. Five had been acquired from legitimate authors, and one Chrome–Edge pair exposed a potential 80,000 users to automatic malicious updates. The framework strips Content Security Policy headers, receives encrypted modules over WebSockets, and injects them into visited pages.

Mozilla's JPEG XL plan takes the opposite approach to native attack surface. Firefox declined to ship an approximately 100,000-line multithreaded C++ decoder and challenged the ecosystem to produce a compact Rust implementation. The resulting jxl-rs enables progressive rendering and helps move JPEG XL toward cross-browser support, while AVIF still wins many web-quality photographic size comparisons.

Key Takeaways
  • If an affected npm version ran, isolate and rebuild the host before rotating credentials; pin a known-good release and audit comment-triggered publishing workflows for trusted actor checks.
  • Inventory browser extensions continuously, remove unused utilities, and treat an ownership change or broad header-modification permission as a new security review event.
  • Evaluate JPEG XL and AVIF with representative images and progressive rendering requirements; codec implementation safety is part of the browser platform decision.